39,304 karma · joined June 20, 2012
http://www.mjt.me.uk
hn@mjt.me.uk
For 99% of users, the model knows it's in the /home/joesmith/whatever repo and `git log` shows the last change was by `joe.smith@example.com` - trying to keep the user's identity secret from the model would be nigh-impossible so I think anthropic gave up on even trying.
Then the credit card processor asks for card details, full address, phone number, captcha, browser fingerprinting, IP address reputation, validate the payment in your bank's app, reject foreign cards, reject prepaid cards, and so on.
Then a customer like me who is literally at the checkout trying to give them money isn't allowed to.
And they're selling digital goods - pixels are free, a non-paying customer doesn't cost them anything!
And another in Dresden: https://www.youtube.com/watch?v=cQUpQZAeA3w https://www.diesachsen.de/en/politics/a-zebra-crossing-in-dr... "In the summer of 2025, unknown individuals painted a crosswalk on the roadway along the busy street in Neustadt to provide safe access to the Heinrich Schütz Conservatory. The city promptly blocked off the crossing with warning cones [...] stating that unauthorized crosswalks constitute not only property damage but also a dangerous interference with traffic. Furthermore, traffic signs installed without authorization constitute an administrative offense under the Road Traffic Code."
In Los Angeles https://www.latimes.com/california/story/2026-10-16/risking-... "Risking arrest, he paints illicit crosswalks across L.A. ‘We can’t wait any longer’" (initially repainting faded crosswalks, rather than creating new ones)
And an example in Saskatoon, visible only in the 2015 street view image https://maps.app.goo.gl/3zWAkjtSEATswcWm8
Every LLM company is built on taking a fast-and-loose approach to intellectual property.
Why should the purported legal protections on my LLM conversations be any different to the purported legal protections on those pirated ebooks, scraped newspaper websites, scraped photos, and suchlike?
Well, it doesn't. The retailer has a team of techs (or an outsourced vendor) rotating between stores, who are cleaning and replacing air filers, checking lubricants, and so on. They could certainly apply occasional changes to settings.
But to the product manufacturer - the remote management feature literally requires less than $2 of hardware. Hell, it might even save money, by removing screens and buttons.
And the person buying the refrigerator wants something that logs and monitors temperatures, for food safety. And they don't know anything about cybersecurity.
So when the manufacturer says that for just a little more they have a remote monitoring option, which not only provides the monitoring needed for food safety but also reduces maintenance costs - it sounds good to them. They don't realise they're signing up for a multi-million-dollar loss when they get hacked and have to throw out a load of products.
An academic can be an ivory tower type who thinks sports matches, superhero movies, social media and star musicians are a waste of time.
But politicians who think the Superbowl is a waste of time, that star wars is for children, and that Taylor Swift's music sucks pretty quickly figures out sharing those opinions loses far more votes than it gains.
Intelligence? Problem solving? Understanding statistics? Speaking in front of rooms full of people? Communicating complex ideas clearly? Useful for both jobs.
But an academic can be bookish, shy or haughty. Pursuing your own ideas is actively encouraged. There are arguments - but the main audience for the debates are other academics. They needn't collaborate on research with anyone they don't want to, and when they do collaborate everyone has the same destination in mind even if they disagree about the route to get there. When dealing with students, they've all chosen to be there, passed exams and paid money. The work is mostly low-medium stakes, with time to get important things right. And of course they have excellent job security.
Politicians, though? Gotta love campaigning and talking to voters. Gotta all get together behind the party's national platform. Even colleagues in your party are rivals because everyone wants the top job. 'Debates' all about playing to the audience and getting 3-second soundbites for social media, not engaging with the substance of arguments. No choice in who you collaborate with, including people with deep-seated disagreements about things like tax, debt, spending. Gotta represent voters many of whom hate you. Do well at the job and high stakes things you didn't even do get blamed on you, like train crashes and oil markets getting expensive. Oh, and every 4-5 years you're fired and get to re-apply for your job.
A lot of exercise equipment manufacturers will display very approximate numbers, based on assumptions the user can adjust if they want (but they seldom do).
If you jump on a treadmill at the gym and set it to a brisk walk, it'll show you a 'calories burned' count that goes up by 7 calories per minute based on your speed and an average adult's weight.
It doesn't have to be all that accurate to motivate the user to just do 5 more minutes, and to put a checkmark on a product feature list.
S6. Summary of indoor cycling (Peloton) workouts by year (2018–2025)
2018 (age 70): 11 workouts, 20 min, 171 watts
2020 (age 71): 14 workouts, 60 min, 175 watts
2021 (age 72): 140 workouts, 30 min, 177 watts
2022 (age 73): 164 workouts, 20 min, 167 watts
2023 (age 74): 73 workouts, 30 min, 187 watts
2024 (age 75): 59 workouts, 45 min, 165 watts
2025 (to march): 69 workouts, 30 min, 165 watts
Going up to 5-6 workouts per week is a step up, but this wasn't an inexperienced rider. And who knows how much outdoor cycling they did, which the Peloton wouldn't have recorded?
Back in 2016 a then-huge Ethereum smart contract called "The DAO" [1] had a loophole that let an attacker extract a third of all the funds.
But a lot of the developers and miners had either lost money themselves, or had friends who'd lost money, or felt the embarrassing incident was devaluing their own Ethereum holdings. So they decided to allow takesies-backsies.
There's probably a philosophical lesson there about power and who the rules really apply to.
Which is something that happens inside a trust boundary. After all, if an untrusted third party gets to install your OS it's game over, UEFI bug or not.
And consumer devices often don't have a network card - or come with PXE disabled in the BIOS.
As I recall, EV certificates also had the 'problem' that a lot of companies trade under names that aren't their full legal name, making the EV cert confusing. To use modern examples, twitter.com having an EV cert for "Space Exploration Technologies Corp", google.com having an EV cert for "Alphabet Inc" and suchlike.
Because, as a German academic once explained to me (years before the rise of LLMs), if you want your ideas to be influential you need people to read your papers, and you get a heck of a lot more readers when publishing in English than you do publishing in German.
Unfortunately, it's much more difficult to draw a clear line once you start allowing some AI writing tools.
And these days, you can get an LLM to stitch those functions together
And it's been possible to get Windows-style self-unlocking FDE for 10+ years, such as by using Ubuntu Core - it just costs a bit, and most users aren't willing to pay $$$ to type one less password.
The design of the TPM makes much more sense for a closed-source operating system, where making it impossible to run a non-microsoft-signed OS protects you against rootkits. Open source OSes don't get that benefit, and the remaining benefits are very minor (and come with big downsides) so I can see why open source developers weren't in a hurry.
Yes, I'm trying to say it's a false dichotomy. There are plenty of other ways you could organise a justice system, many of which would lead to more just results.
For example - a fixed price system. 8 hours wages from the two parties to the dispute buys 30 minutes with one judge and two lawyers. More than enough time to deal with a minor matter like a scratched car. Or if you prefer a continental-style inquisitorial system, you can lose the lawyers and have 90 minutes with a judge. The fees mean judges and lawyers take home 5x the average salary.
If we've got a Lamborghini justice system, delivering amazing performance to people with a spare $250k and doing nothing for anyone else - some would say that's not the right price/performance trade off.
Really?
I was under the impression that when a new CA starts operating, they get their certificates cross-signed by older CAs, to ensure their certificates work on older devices? Lets Encrypt did something like that [1] - although they started operating in ~2015, their certificate chain started with a root valid from October 2000 to October 2021 [2]
After all, many website operators want users to be able to connect even if they're using prehistoric Android versions.
You can access Wikipedia with Android 4.4 which was released 13 years ago [3] (although apparently not on the slightly older Android 4.3)
[1] https://letsencrypt.org/2015/10/19/lets-encrypt-is-trusted [2] https://scotthelme.co.uk/lets-encrypt-old-root-expiration/ [3] https://www.ssllabs.com/ssltest/analyze.html?d=en.wikipedia....
But if you only want to MITM the connection used by 'pip' to install python wheels - that doesn't check for CT records at all.
I feel this is the kind of discussion that would really benefit from a number of concrete examples.
The thing is, that only helps Tor users who are happy for their PC to contain evidence of what they were doing over Tor (such as a known hosts file listing).
If your security requirements are so high your PC contains no evidence whatsoever of what you were doing over Tor, you wouldn't get the banner.
The simplest way is to just launch the servers yourself, using a cloud provider. Tor is completely OK with exit node operators being anonymous, and with exit nodes running in cheap cloud data centres.
If someone finds it burdensome to review my 50-line AI-generated bug fix, adding 200 lines of tests only gives them more lines to review.
Consider how many American companies exclusively manufacture in the far east.
If a European buys a product "made by" Apple or nvidia or Nike or Levis - that's not an American export, it's an export of Indonesia, China, Vietnam, Taiwan, or wherever. America still gets the profits, though.
RSA was good enough for my grandfather, and it's good enough for me.
Almost every programming language and database I've ever used assumes 86400-second days, ignoring leap seconds. And one of the popular ways of applying leap seconds was a 'smear' [1] running every clock slightly fast for about 24 hours, rather than having a 61-second minute.
So instead of UTC we actually all use a slightly elastic timescale with the name of UTC, most of the time aligned with UTC, but with the linearity of TAI, and the desirable property that if I'm going to a concert at 19:00 in a year's time and a leapsecond is announced and implemented in the interim, the concert doesn't change to 18:59:59.